Fixing withCSRF to correctly get the CSRF token.

The request was assuming XML, which caused jQuery to blow its top since the response was not valid XML.  If we set the response to HTML, we can set the CSRF token directly from the response, without using response.body.

issue #177